attributeCondition property
A Common Expression Language expression, in plain text, to restrict what otherwise valid authentication credentials issued by the provider should not be accepted.
The expression must output a boolean representing whether to allow the
federation. The following keywords may be referenced in the expressions: *
assertion: JSON representing the authentication credential issued by the
provider. * google: The Google attributes mapped from the assertion in
the attribute_mappings. * attribute: The custom attributes mapped from
the assertion in the attribute_mappings. The maximum length of the
attribute_condition expression is 4,096 characters. Providing a
condition longer than this will result in an error. If unspecified, all
valid authentication credentials are accepted. However, multi-tenant
identity providers (such as GitHub or Terraform Cloud) require an
attribute_condition to prevent token spoofing. The following example
shows how to only allow credentials with a mapped google.groups value of
admins: "'admins' in google.groups"
Optional.
Implementation
core.String? attributeCondition;